{"version":"2.1.224","anchor":"mcp-oauth-checks-the-issuer-a-server-echoes-back-telemetry-o","canonical_anchor":"mcp-oauth-checks-the-issuer-a-server-echoes-back-telemetry-o","heading":"MCP OAuth checks the issuer a server echoes back, telemetry only for now","tier":"internal","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224\/e\/mcp-oauth-checks-the-issuer-a-server-echoes-back-telemetry-o","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224","markdown":"### MCP OAuth checks the issuer a server echoes back, telemetry only for now\n\nMCP OAuth now checks a server's echoed issuer, but only records mismatches rather than blocking.\n\n**What**\n\nDuring MCP OAuth discovery Claude Code now validates itself that the issuer a server echoes back matches the URL that was asked for, at three points: the RFC 9728 chain, the legacy path fallback and refresh rediscovery. Controlled by `tengu_mcp_issuer_strict_echo`, whose in-source fallback is \"observe\": mismatches are recorded and the connection proceeds. Only a remote config value switches it to enforce, where a cross-origin echo fails the connection.\n\n**Details**\n\n- The SDK's own checks are turned off (`skipIssuerMetadataValidation`, `skipIssuerValidation`) in favour of the in-house comparison, on SSE and HTTP transports.\n- Mismatches emit `tengu_mcp_oauth_issuer_echo_mismatch` with site, mode, outcome, an origin relation of `same_origin`, `cross_origin` or `unparseable`, the differing parts (scheme, host, port, path, query, fragment, userinfo, normalization_only) and hashed issuers.\n- In enforce mode the failure raises `IssuerEchoCrossOriginError`, surfaces as a new `issuer_echo_denied` outcome for token refresh and revoke, and is excluded from retry.\n\n**Evidence**\n\n`tengu_mcp_issuer_strict_echo`, `Issuer echo cross-origin mismatch (RFC 8414 \\xA73.3): expected `\n\n- Flag `tengu_mcp_issuer_strict_echo`: Not enough to say (read for one account on one subscription tier against v2.1.224; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: MCP\n- Tier: Under the hood\n- Useful: 3\/5\n- Signal: 3\/5"}